Wfuzz

Wfuzz is a tool designed for bruteforcing Web Applications, capable of discovering resources not linked like directories, servlets, scripts, etc. It can bruteforce GET and POST parameters to check for different kinds of injections including SQL, XSS, LDAP, and more. Additionally, it supports bruteforcing form parameters such as User/Password and general fuzzing tasks.

The tool replaces FUZZ keywords in URLs or parameters with values from specified payloads, such as wordlists, enabling systematic testing of web endpoints. It provides filtering options to hide common responses like 404s and focus on interesting results. Wfuzz is versatile for web security testing, from directory enumeration to parameter manipulation.

Usage involves specifying payloads with -z, URLs with FUZZ placeholders, and various options for output, concurrency, and filtering to tailor scans efficiently.

Wfuzz operates by replacing FUZZ, FUZZnZ, or FUZZ{baseline_value} keywords in URLs, POST data, headers, or authentication strings with values from payloads specified via -z (e.g., file wordlists) or iterators (-m). It sends concurrent HTTP requests (default 10, configurable with -t), supports methods like GET/POST/HEAD via -X, and follows redirections (-L). Responses are filtered by status codes (--hc/--sc), size (--hl/--sl), regex (--ss/--hs), or expressions (--filter), using baseline comparisons (BBB). Scripts and plugins enhance scanning, with proxy support (-p), delays (-s), and output customization (-o, -f). Encoders chain transformations on payloads.